Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe
Resource
win10v2004-20220414-en
General
-
Target
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe
-
Size
554KB
-
MD5
b2deb3fa1acb774a1e5b17013d474d71
-
SHA1
e32774f940c4e8bdb19e0d33689bf4f56ab90895
-
SHA256
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a
-
SHA512
913fc4b339ac0af4c89c3ad2b0af2ef29f245e91befff960bd3b78da9071c8c8457ef1ace01d91e0c2f58bacbd87b7b2f0734c86cd27156ecd837bce035aec8b
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewylinls = "\"C:\\Windows\\ynoxidux.exe\"" explorer.exe -
Processes:
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exea898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exedescription pid process target process PID 2044 set thread context of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 1648 set thread context of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\ynoxidux.exe explorer.exe File created C:\Windows\ynoxidux.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 780 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exepid process 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 912 vssvc.exe Token: SeRestorePrivilege 912 vssvc.exe Token: SeAuditPrivilege 912 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exea898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exeexplorer.exedescription pid process target process PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 2044 wrote to memory of 1648 2044 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe PID 1648 wrote to memory of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe PID 1648 wrote to memory of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe PID 1648 wrote to memory of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe PID 1648 wrote to memory of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe PID 1648 wrote to memory of 1808 1648 a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe explorer.exe PID 1808 wrote to memory of 780 1808 explorer.exe vssadmin.exe PID 1808 wrote to memory of 780 1808 explorer.exe vssadmin.exe PID 1808 wrote to memory of 780 1808 explorer.exe vssadmin.exe PID 1808 wrote to memory of 780 1808 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe"C:\Users\Admin\AppData\Local\Temp\a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe"C:\Users\Admin\AppData\Local\Temp\a898a3c616fab1e3c8f05eacf9ba459af21aefb63937cfc10778e77aaa375b3a.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:780
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ywynugoxasijikec\01000000Filesize
554KB
MD58f0e0b57e90263fc57cf2bc4616229cf
SHA10ff97a77448db7b79ab1c44bc23e57c7ca688b48
SHA256a8f1fc3259ece4871f81a70f1a54bd286ed573779437a215f93fd78dfd7f7db3
SHA512f21d4c12ac05f489eb30dfe05f60b86c11ab573bcc754eac0ceb6adddca7d5f1ef3da1d9410764b396cde1aaa3e9d4f9d7068d692e8b63ee1101c0635da660c7
-
memory/780-79-0x0000000000000000-mapping.dmp
-
memory/1648-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-58-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-65-0x000000000040A61E-mapping.dmp
-
memory/1648-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1648-77-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1808-73-0x000000000009A160-mapping.dmp
-
memory/1808-75-0x0000000074F11000-0x0000000074F13000-memory.dmpFilesize
8KB
-
memory/1808-71-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1808-69-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1808-78-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1808-80-0x00000000729C1000-0x00000000729C3000-memory.dmpFilesize
8KB
-
memory/2044-54-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB